CVE-2026-64071

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64071", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.031Z", "datePublished": "2026-07-19T15:39:47.162Z", "dateUpdated": "2026-11-06T16:34:25.525Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T15:39:47.162Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward. This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n nvme_setup_host_mem()\n nvme_alloc_host_mem_single() -> sets dev->hmb_sgt\n nvme_set_host_mem() -> fails with -EIO\n nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it\n return error\n\n nvme_probe() error path:\n nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt->sgl->dma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n <TASK>\n dma_free_noncontiguous+0x3b/0x130\n nvme_free_host_mem+0x30/0xf0 [nvme]\n nvme_probe.cold+0xcc/0x275 [nvme]\n local_pci_probe+0x43/0xa0\n pci_device_probe+0xeea/0x290\n really_probe+0xf9/0x3b0\n __driver_probe_device+0x8b/0x170\n driver_probe_device+0x24/0xd0\n __driver_attach_async_helper+0x6b/0x110\n async_run_entry_fn+0x37/0x170\n process_one_work+0x1ac/0x3d0\n worker_thread+0x1b8/0x360\n kthread+0xf7/0x130\n ret_from_fork+0x2d8/0x3a0\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nFix this by setting dev->hmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/pci.c"], "versions": [{"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c", "status": "affected", "versionType": "git"}, {"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "7c89f474005d8377525d2991930b7432ee193a52", "status": "affected", "versionType": "git"}, {"version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/pci.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"}, {"url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"}, {"url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"}], "title": "nvme-pci: fix use-after-free in nvme_free_host_mem()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:29:42.686574Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:34:25.525Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:29:42.686574Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:29:43.942Z"}}], "cna": {"title": "nvme-pci: fix use-after-free in nvme_free_host_mem()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c", "versionType": "git"}, {"status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "7c89f474005d8377525d2991930b7432ee193a52", "versionType": "git"}, {"status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8", "versionType": "git"}], "programFiles": ["drivers/nvme/host/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/pci.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"}, {"url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"}, {"url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward. This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n nvme_setup_host_mem()\n nvme_alloc_host_mem_single() -> sets dev->hmb_sgt\n nvme_set_host_mem() -> fails with -EIO\n nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it\n return error\n\n nvme_probe() error path:\n nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt->sgl->dma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n <TASK>\n dma_free_noncontiguous+0x3b/0x130\n nvme_free_host_mem+0x30/0xf0 [nvme]\n nvme_probe.cold+0xcc/0x275 [nvme]\n local_pci_probe+0x43/0xa0\n pci_device_probe+0xeea/0x290\n really_probe+0xf9/0x3b0\n __driver_probe_device+0x8b/0x170\n driver_probe_device+0x24/0xd0\n __driver_attach_async_helper+0x6b/0x110\n async_run_entry_fn+0x37/0x170\n process_one_work+0x1ac/0x3d0\n worker_thread+0x1b8/0x360\n kthread+0xf7/0x130\n ret_from_fork+0x2d8/0x3a0\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nFix this by setting dev->hmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T15:39:47.162Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64071", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:34:25.525Z", "dateReserved": "2026-07-19T07:54:57.031Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T15:39:47.162Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9525e3a6fbb1d126a22ab2ee86ddea25af581a7c", "status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "versionType": "git"}, {"lessThan": "7c89f474005d8377525d2991930b7432ee193a52", "status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "versionType": "git"}, {"lessThan": "b35a13036755c5803168a7cb93bc66035c3e65b8", "status": "affected", "version": "63a5c7a4b4c49ad86c362e9f555e6f343804ee1d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix use-after-free in nvme_free_host_mem()\n\nnvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()\nbut never clears the pointer afterward. This leads to a use-after-free\nif nvme_free_host_mem() is called twice in the same error path.\n\nThis can happen during nvme_probe() when nvme_setup_host_mem() succeeds\nin allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()\nfails with an I/O error:\n\n nvme_setup_host_mem()\n nvme_alloc_host_mem_single() -> sets dev->hmb_sgt\n nvme_set_host_mem() -> fails with -EIO\n nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it\n return error\n\n nvme_probe() error path:\n nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free\n\nThe second call dereferences the freed sgt, causing a NULL pointer\ndereference in iommu_dma_free_noncontiguous() when it accesses\nsgt->sgl->dma_address (the backing memory has been freed and zeroed).\n\nThis is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC\nEnvoy Express behind a Dell WD22TB4 dock) where the device intermittently\nreturns I/O errors during HMB setup due to PCIe link instability.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80\n Call Trace:\n <TASK>\n dma_free_noncontiguous+0x3b/0x130\n nvme_free_host_mem+0x30/0xf0 [nvme]\n nvme_probe.cold+0xcc/0x275 [nvme]\n local_pci_probe+0x43/0xa0\n pci_device_probe+0xeea/0x290\n really_probe+0xf9/0x3b0\n __driver_probe_device+0x8b/0x170\n driver_probe_device+0x24/0xd0\n __driver_attach_async_helper+0x6b/0x110\n async_run_entry_fn+0x37/0x170\n process_one_work+0x1ac/0x3d0\n worker_thread+0x1b8/0x360\n kthread+0xf7/0x130\n ret_from_fork+0x2d8/0x3a0\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nFix this by setting dev->hmb_sgt to NULL after freeing it, so the\nsecond call takes the multi-descriptor path which safely handles the\nalready-cleaned-up state."}], "id": "CVE-2026-64071", "lastModified": "2026-11-06T17:18:35.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64071", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:29:42.686574Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:47.687", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvme-pci: fix use-after-free in nvme_free_host_mem()", "id": "2502612", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502612"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's NVMe over PCI Express (NVMe-PCIe) driver. This vulnerability, a use-after-free error, occurs when the system attempts to free host memory twice in certain error handling scenarios, particularly during Host Memory Buffer (HMB) setup for NVMe devices. An attacker could potentially trigger this condition by causing I/O errors, leading to a NULL pointer dereference and a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-64071", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64071\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64071\nhttps://lore.kernel.org/linux-cve-announce/2026071913-CVE-2026-64071-5a2d@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63a5c7a4b4c49ad86c362e9f555e6f343804ee1d,9525e3a6fbb1d126a22ab2ee86ddea25af581a7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63a5c7a4b4c49ad86c362e9f555e6f343804ee1d,7c89f474005d8377525d2991930b7432ee193a52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63a5c7a4b4c49ad86c362e9f555e6f343804ee1d,b35a13036755c5803168a7cb93bc66035c3e65b8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T17:15:09.001947+00:00", "updated": "2026-09-03T17:00:06.890262+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}